# Linux Kernel 5.10.269

- Product: Linux Kernel (https://whatsnew.fyi/product/linux-kernel)
- Vendor: Linux Kernel Organization
- Date: 2026-09-02
- Version: 5.10.269
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.269
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.10.269
- Labels: longterm

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — fix use-after-free of usb_device in usbdev_release()
- **fixed** — fix use-after-free in c67x00_add_iso_urb()
- **removed** — drop broken carrier detect support in USB serial spcp8x5
- **fixed** — fix slab OOB read in interrupt URB callback in USB serial option
- **fixed** — fix OOB write in snd_usbmidi_novation_output()
- **changed** — strengthen error handling in hub_hub_status()
- **added** — add lock to usb_wakeup_notification()
- **fixed** — zero stale crypto bits in KVM s390 vsie
- **fixed** — fix source scatterlist length access in crypto mxs-dcp
- **fixed** — use scatterlist length before DMA mapping in crypto atmel-tdes
- **changed** — reject swapon() on filesystem-level encrypted files
- **fixed** — clear IPv4 control block on IPIP decapsulation in ipv6 seg6
- **fixed** — fix xfrm_state_construct() auth-trunc leak
- **fixed** — validate routing header segments_left in xfrm ah6
- **fixed** — drop ESP-in-TCP packets with no ingress device in xfrm
- **fixed** — fix UAF during close in xfrm espintcp
- **changed** — keep port count until LUN teardown completes in usb gadget f_tcm
- **changed** — disable dynamic ID support in usb usbtest
- **fixed** — unregister tty ldisc on later init failures in accessibility speakup
- **added** — add error handling in fpga dfl fme

44 commits in this release:

- Linux 5.10.269
- usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- USB: serial: spcp8x5: drop broken carrier detect support
- USB: serial: option: fix slab OOB read in interrupt URB callback
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- usb: core: Strengthen error handling in hub_hub_status()
- usb: core: Add lock to usb_wakeup_notification()
- KVM: s390: vsie: zero stale crypto bits
- crypto: mxs-dcp - fix source scatterlist length access
- crypto: atmel-tdes - use scatterlist length before DMA mapping
- mm/swap: reject swapon() on filesystem-level encrypted files
- ipv6: seg6: clear IPv4 control block on IPIP decapsulation
- xfrm: fix xfrm_state_construct() auth-trunc leak
- xfrm: ah6: validate routing header segments_left
- xfrm: drop ESP-in-TCP packets with no ingress device
- xfrm: espintcp: fix UAF during close
- usb: gadget: f_tcm: keep port count until LUN teardown completes
- usb: usbtest: disable dynamic ID support
- accessibility: speakup: unregister tty ldisc on later init failures
- fpga: dfl: fme: add error handling
- HID: input: read battery capacity from its actual report offset
- nvmet-tcp: bound SGL data length before allocating command buffers
- nfc: nci: add data_len bound checks to activation parameter extractors
- HID: magicmouse: do not keep a stale msc->input if no input is claimed
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- nilfs2: reject invalid block index in GC ioctl
- ext4: propagate errors from fast commit range replay
- kcov: fix data corruption and race conditions on PREEMPT_RT
- ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
- Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"
- Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"
- selinux: switch two allocations to use kzalloc_objs()
- Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
- bpf: Fix use-after-free in offloaded map/prog info fill
- KVM: arm64: Prevent access to vCPU events before init
- jfs: add check read-only before txBeginAnon() call
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- bpf: Remove tst_run from lwt_seg6local_prog_ops.
- io_uring/io-wq: fix worker accounting when canceling creation callbacks
- ipvs: reload ip header after head reallocation
- ext4: don't enable DAX on new encrypted files
- ipv6: mcast: Fix use-after-free when processing MLD queries
- RDMA/rxe: Fix OOB in free_rd_atomic_resources()